Skip to main content
L-L
L-L
New Member
October 29, 2024
Question

Outbound firewall auth + Microsoft Entra ID SAML IdP - Let's Encrypt cert for FGT SP

  • October 29, 2024
  • 1 reply
  • 2198 views

Hi All,

 

Managed to get outbound firewall authentication using Entra ID as SAML IdP to work.  
My issue is this.  I do not want to stay installing the Fortigate CA SSL cert on each endpoint that needs internet access, as instructed in the Fortigate's how-to site. 

 

Was wondering if I could use Let's Encrypt SSL cert for this?  Anyone know the way forward, or perhaps managed to get it working like this?  I already tried using a Let's Encrypt cert pointing to my public IP in FGT and configured this in my EntraID config, but doesn't work.  At a certain point, the local computer gets re-directed to the local internal IP address of the fortigate and seems to ignore the FQDN configured in EntraID and in FGT SP.

 

Any ideas?

 

Much appreciated. 

1 reply

AnthonyH
Staff
AnthonyH
Staff
October 29, 2024

Hello L-L,

 

Could you share if the SAML configuration on the FortiGate is pointing to FQDN? And two things to check: 1) Under SSLVPN Settings -> Server certificate, it is using the lets encrypt cert? 2) Under User & Authentication -> SSO, are you also referencing the lets encrypt here as well?

L-L
L-LAuthor
New Member
October 30, 2024

Hello Anthony,

 

SAML configuration on the FortiGate is pointing to FQDN which resolves to the Public IP address (WAN1) on the FGT itself.

 

I'm using FortiOS ver 7.4.5, on a FGT 60e, so SSLVPN settings is not available for me.  

 

Under User & Authentication -> SSO, I AM referencing to the "Lets encrypt" cert.

L-L
L-LAuthor
New Member
October 30, 2024

So, after some tinkering I though to myself, if it wants to use the internal interface IP address, why not make it happy?  So what I did was to enable the local DNS server on the FTG itself and create a zone with the same domain name as the ones used for the 'Let's Encrypt' cert.  Like this I create a split-brain DNS.  Also, to keep in mind the local-in policies which doesn't seem to allow AuthD from an external interface. 

Terms & ConditionsAccessibility statement